CVE-2026-93200: i3c: master: Fix use-after-free of master->this
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix use-after-free of master->this
sysfs attribute callbacks for the master controller device dereference master->this. However, master->this is freed in i3cmasterdetachfreedevs() before the master device itself is released.
As a result, sysfs accesses can dereference a freed master->this pointer, leading to a use-after-free.
Keep master->this alive until i3cmasterdevrelease(), which is called after the master device and its sysfs state are being torn down. Do not free master->this as part of the normal device detach path.
On the error path in i3cmastersetinfo(), reset master->this and bus.curmaster to NULL before freeing the allocated device.
Affected Software
Event History
Frequently Asked Questions
What condition is required to trigger the use-after-free?
An access to sysfs attributes for an I3C master controller must occur after the normal device detach path has freed master->this but before the master device and its sysfs state have been released.
Which systems are exposed?
Systems using the Linux kernel I3C master controller subsystem are exposed when the affected lifetime ordering is present and sysfs callbacks can run during or after device detachment.
How can this be mitigated if the fix cannot be applied immediately?
The provided information does not specify a workaround. The fix changes object lifetime handling so master->this remains valid until i3c_masterdev_release() tears down the master device and sysfs state.